Senior App Security Engineer — Remote + Equity

Oshi Health; California City (CA); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

401(k) retirement plan

Remote-first work

Job summary

Oshi Health, a remote-first healthcare technology platform, seeks a Senior Security Engineer to own the security of our cloud-native SaaS platform. You will design security architecture, manage identity and secrets, and ensure secure SDLC practices across AWS and AI workflows, reporting to the Sr.

Director of IT & Security. Ideal candidates have deep hands-on security experience, including IAM, SAST/DAST, and data protection, plus a strong track record in regulated environments like healthcare

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets.
• Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.
• Comfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain a tradeoff clearly to both engineers and non-technical executives.
• Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).

Responsibilities

• Own application and product security, including threat modeling, secure design review, and secure code review, with a focus on the access‑control and secrets‑exposure flaws that matter most for a member‑facing healthcare app and its APIs.
• Design and own the security architecture for Oshi's shift to an agentic software development lifecycle, including phase‑gate criteria, out‑of‑band controls so AI‑written code is never its own security gate, and tested clawback procedures for when risk spikes.
• Build and run non‑human identity and secrets management at scale, covering service accounts, scoped tokens, OAuth grants, and machine credentials across our SaaS and AWS estate.
• Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.
• Enforce and tune our security tooling so it does real work, including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS‑enforced review on sensitive paths.
• Review AI and third‑party vendor integrations before they touch PHI, evaluating data flows, retention, and data loss‑prevention needs with healthy skepticism toward vendor security claims.
• Own vulnerability management and the penetration‑testing relationship, driving findings to closure and feeding recurring issues back into the development process.
• Support HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and build the automation that lets a small security function operate with outsized leverage.

Skills

Security engineering

Cloud security (AWS)

SAST/DAST tooling

Identity and access management

AI/LLM security

Risk-based decision making

Scripting (Python/Shell)

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security/CodeQL

Secret scanning

Software supply-chain security

OAuth/OIDC/SAML tooling

Job description

Oshi Health, a remote-first healthcare technology platform, seeks a Senior Security Engineer to own the security of our cloud-native SaaS platform. You will design security architecture, manage identity and secrets, and ensure secure SDLC practices across AWS and AI workflows, reporting to the Sr.

Director of IT & Security. Ideal candidates have deep hands-on security experience, including IAM, SAST/DAST, and data protection, plus a strong track record in regulated environments like healthcare